One of the nicer options of tcpdump under Linux is the -C (that is a capital C). This allows you to write the captured traffic to a file and have the file rotated at a given size. According to the man-pages :
-C
Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
How long before someone adds this to the openbsd version of tcpdump?
Make a diff with the code and it’d be there, if the code was good enough.
Just be sure that the copyright is proper, they’re very stiney about people taking code from a base and sending patches without the original code’s copyright there.